WikiLeaks Document Release 

http: / /wikileaks.org/wiki / CRS-RL32909 
February 2, 2009 

Congressional Research Service 
Report RL32909 

Federal Protection for Human Research Subjects: An 
Analysis of the Common Rule and Rs Interactions with FDA 
Regulations and the HIPAA Privacy Rule 

Erin D. Williams, Domestic Social Policy Division 
July 19, 2005 

Abstract. Legislation to revise the Common Rule has been introduced in every Congress since 1997. In 
the 109th, the PhRMA Act of 2005 (H.R. 870) was introduced, to provide criminal penalties for concealing 
evidence of serious drug adverse events. Bills introduced in former Congresses include the Protection for 
Participants in Research Act of 2003 (H.R. 3594, 108th Congress), the Research Revitalization Act of 2002 
(S. 3060, 107th Congress), and the Human Research Subject Protections Act of 2002 (H.R. 4697, 107th Congress). 



http://wikileaks.org/wiki/CRS-RL32909 



Order Code RL32909 



CRS Report for Congress 

Received through the CRS Web 



Federal Protection for Human Research Subjects: 

An Analysis of the Common Rule 
and Its Interactions with FDA Regulations 

and the HIPAA Privacy Rule 



Updated July 19, 2005 



Erin D. Williams 
Specialist in Bioethical Policy 
Domestic Social Policy Division 



Congressional Research Service ❖ The Library of Congress 





http://wikileaks.org/wiki/CRS-RL32909 



Federal Protection for Human Research Subjects: An 
Analysis of the Common Rule and Its Interactions with 
FDA Regulations and the HIPAA Privacy Rule 

Summary 

The Common Rule governs research that is conducted on human beings if it is 
funded by one of 19 federal agencies. It requires a review of proposed research by 
an Institutional Review Board (IRB), the informed consent of research subjects, and 
institutional assurances of compliance with the regulations. 

In 1974, 45 CFR 46 was published following some cases of harm to human 
subjects, such as those caused by thalidomide drug trials and the United States Public 
Health Service syphilis study in T uskeegee, Alabama. The regulations had their roots 
in numerous international agreements, such as the Nuremberg Code and the 
Declaration of Helsinki, and domestic policies, such as those put forth by the 
Department of Health, Education and Welfare (DHEW; now the Department of 
Health and Human Services, HHS). In 1991, 16 federal agencies adopted the terms 
of 45 CFR 46, Subpart A, thus creating the Common Rule. 

Since the Common Rule took effect, events like the death of Jesse Gelsinger in 
1999 due to his participation a clinical trial have prompted scrutiny of the Rule and 
its ability to protect research subjects. In order to help enhance research subject 
protections, in 2000 HHS removed the Office for Protection from Research Risks 
(OPRR) from the National Institutes of Health (NIH), and created a new office — the 
Office for Human Research Protections (OHRP) — in an elevated position in HHS. 
In addition, groups like the National Bioethics Advisory Commission and the 
National Academies raised the following policy questions: (1) Should the Common 
Rule be applied to non-federally funded research, social and behavioral research, 
international clinical trials, and research with human biological materials? (2) Do 
existing provisions ensure the participation and protection of children, prisoners, 
minorities, those with diminished capacity, pregnant women, fetuses, neonates, and 
people in emergency situations? (3) What should be the requirements regarding 
IRB s’ membership, responsibilities, training, and registration? (4) How should 
conflicts of interest, accreditation, ongoing research, and adverse event reporting be 
handled? (5) How should basic and research-related medical care’s cost, and IRB 
liability for harm be handled? (6) How should the human subjects protection system 
be reassessed, adequate resources ensured, and the burdens and benefits of amending 
regulations appropriately weighed? (7) How does 45 CFR 46 interact with the Food 
and Drug Administration (FDA) regulations for the protection of human subjects (21 
CFR 50 and 56), and the Privacy Rule of the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA) (45 CFR 146)? 

Fegislation to revise the Common Rule has been introduced in every Congress 
since 1997. In the 109 th , the PhRMA Act of 2005 (H.R. 870) was introduced, to 
provide criminal penalties for concealing evidence of serious drug adverse events. 
Bills introduced in former Congresses include the Protection for Participants in 
Research Act of 2003 (H.R. 3594, 108 th Congress), the Research Revitalization Act 
of 2002 (S. 3060, 107 th Congress), and the Human Research Subject Protections Act 
of 2002 (H.R. 4697, 107 th Congress). This report will be updated as needed. 
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Federal Protection for Human Research 
Subjects: An Analysis of the Common Rule 
and Its Interactions with FDA Regulations 
and the HIPAA Privacy Rule 



Introduction 

Congress has shown a keen interest in the Common Rule largely because of the 
federal government’s longstanding investment in medical research, and its interest 
in research-subject safety. The Common Rule (45 CFR 46, Subpart A) 1 is a set of 
regulations that govern most federally funded research conducted on human beings. 
Its three basic requirements are aimed at protecting research subjects: the informed 
consent of research subjects, a review of proposed research by an Institutional 
Review Board (IRB), and institutional assurances of compliance with the regulations. 

Informed Consent. Meaningful informed consent is one cornerstone of 
human subjects protections. To provide informed consent, a potential research 
subject must both understand what participation in a study entails (in other words, be 
informed), and agree to participate (consent). The Common Rule requires that a 
researcher obtain informed consent (usually in writing) from a living person or their 
legally authorized representative before the person can be admitted to a study. 

The Common Rule’s informed consent regulations focus primarily on the 
elements and documentation of informed consent rather than on the process used to 
obtain it. As to the process, the regulations require that informed consent be sought 
only under circumstances that provide the prospective subject sufficient opportunity 
to consider whether or not to participate, and that minimize the possibility of 
coercion or undue influence. Regarding the content and documentation, the 
Common Rule requires that information be given in language understandable to the 
subject, and that informed consent be clear of any exculpatory language releasing the 
investigator, the sponsor, the institution or its agents from liability for negligence (45 
CFR 46.116). In addition, the Common Rule specifies that all of the following 
elements must be provided when informed consent is sought (45 CFR 46.116(a)): 



1 The term the Common Rule refers to federal regulations for the protection of human 
research participants that have been adopted by various federal agencies in their respective 
sections of the Code of Federal Regulations (CFR). When provisions of the Common Rule 
are cited in this report, readers are directed to the HHS regulations that served as the basis 
for the Common Rule (45 CFR 46, Subpart A) so that they may easily locate the text. 




http://wikileaks.org/wiki/CRS-RL32909 



CRS-2 



• a statement that the study involves research, an explanation of the 
purposes of the research and the expected duration of the subject’s 
participation, a description of the procedures to be followed, and 
identification of any procedures which are experimental; 

• a description of any reasonably foreseeable risks or discomforts to 
the subject; 

• a description of any benefits to the subject or to others which may 
reasonably be expected from the research; 

• a disclosure of appropriate alternative procedures or courses of 
treatment, if any, that might be advantageous to the subject; 

• a statement describing the extent, if any, to which confidentiality of 
records identifying the subject will be maintained; 

• for research involving more than minimal risk, an explanation as to 
whether any compensation and an explanation as to whether any 
medical treatments are available if injury occurs and, if so, what they 
consist of, or where further information may be obtained; 

• an explanation of whom to contact for answers to pertinent questions 
about the research and research subjects’ rights, and whom to 
contact in the event of a research-related injury to the subject; and 

• a statement that participation is voluntary, refusal to participate will 
involve no penalty or loss of benefits to which the subject is 
otherwise entitled, and the subject may discontinue participation at 
any time without penalty or loss of benefits to which the subject is 
otherwise entitled. 

When informed consent is sought, the Common Rule also requires other 
information to be provided if applicable, such as any additional costs to the subject 
that may result from participation in the research, or a statement that the particular 
treatment or procedure may involve risks to the subject, which are currently 
unforeseeable (45 CFR 46.116(b)). 

IRB Review. The Common Rule’s primary mechanism for ensuring the 
adequacy of informed consent and other aspects of human subjects protection is IRB 
review. IRBs review and have authority to approve, require modifications in (to 
secure approval), or disapprove all research activities covered by the Common Rule 
(45 CFR 46. 109(a)). The Common Rule requires that protocols for human subjects 
research be IRB approved before the research can begin (45 CFR 46.103(b)). The 
Common Rule does not require that IRBs be accredited, 2 but it does require them to 
meet certain membership and review procedures. 

IRBs generally comprise volunteers who examine proposed and ongoing 
scientific research to ensure that human subjects are properly protected. The 
Common Rule (45 CFR 46.107) requires that each IRB have the following: 



2 Accreditation is procedure by which an authoritative body gives formal recognition that 
a body or person is competent to carry out specific tasks. 
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• at least five members; 

• members with varying backgrounds to promote complete and 
adequate review of research activities commonly conducted by the 
institution; 

• members that are not entirely of one profession; 

• at least one member whose primary concerns are in scientific areas 
and at least one member whose primary concerns are in nonscientific 
areas; 

• at least one member who is not affiliated with the institution; 

• a membership diverse in race, gender, and cultural backgrounds, and 
having sensitivity to community attitudes; and 

• if an IRB regularly reviews research that involves a vulnerable 
category of subjects, such as children, prisoners, pregnant women, 
or handicapped or mentally disabled persons, consideration shall be 
given to the inclusion of one or more individuals who are 
knowledgeable about and experienced in working with these 
subjects. 

IRBs are to meet as necessary (in institutions with a high volume of protocols, 
this is often monthly or more frequently; in smaller-volume institutions it is often 
less frequently), to conduct their reviews. Reviews may be conducted only at 
convened meetings at which a majority of the members of the IRB are present, 
including at least one member whose primary concerns are in nonscientific areas. In 
order for the research to be approved, it must receive the approval of a majority of 
those members present at the meeting (45 CFR 46. 108(b)). IRBs are to conduct initial 
reviews of proposed research, and also monitor ongoing research, re-reviewing it at 
least once per year (45 CFR 46. 109(e)). No IRB may have a member participate in 
the IRB’s initial or continuing review of any project in which the member has a 
conflicting interest, except to provide information requested by the IRB (45 CFR 
46.107(e)). To facilitate this monitoring and reevaluation, IRBs are to be provided 
with reports of unanticipated problems involving risks to subjects (or others) that 
arise during research, 3 and to reevaluate the human subjects protections in the 
protocol if necessary (45 CFR 46.103(b)(5)). 

The Common Rule does not specify which procedures an IRB must follow in 
its review of protocols — leaving that to local control — but it does require that there 
be written procedures. The procedures must specify how an IRB will conduct its 
initial and continuing reviews of research, report its findings and actions to the 
investigator and the institution, and determine which projects require review more 
often than annually and which need verification from sources other than the 
investigators that no material changes have occurred since previous IRB review. In 
addition, there must be written procedures that ensure prompt reporting to the IRB 
of unanticipated problems, noncompliance, and proposed changes in research 
activities (45 CFR 46. 103(b)(4)-(5)). 



3 Some unanticipated problems involving risks to subjects may be referred to as adverse 
events (AEs), although the term is not used in the Common Rule itself. 
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The Common Rule requires that an IRB determine that all of the following 
requirements are satisfied in order to approve proposed research (45 CFR 46.1 1 1): 

• informed consent is sought from each subject according to the 
requirements described above; 

• risks to subjects are minimized; 

• risks to subjects are reasonable in relation to anticipated benefits, if 
any, to subjects, and the importance of the knowledge that may 
reasonably be expected to result; 

• that the selection of subjects is equitable; 

• when appropriate, that the research plan makes adequate provision 
for monitoring the data collected to ensure the safety of subjects; 

• when appropriate, that there are adequate provisions to protect the 
privacy of subjects and to maintain the confidentiality of data; and 

• if some or all of the subjects are likely to be vulnerable to coercion 
or undue influence, such as children, prisoners, pregnant women, 
mentally disabled persons, or economically or educationally 
disadvantaged persons, that the study has additional safeguards to 
protect the rights and welfare of these subjects. 

In evaluating risks and benefits, the IRB should consider only those risks and 
benefits that may result from the research (as distinguished from risks and benefits 
of therapies subjects would receive even if not participating in the research). The 
IRB should not consider possible long-range effects of applying knowledge gained 
in the research (for example, the possible effects of the research on public policy) as 
among those research risks that fall within the purview of its responsibility (45 CFR 
46.111(a)(2). The Common Rule leaves the weighing of risks and benefits in 
individual protocols up to local IRBs, enabling them to apply local community 
standards. 

Not every research project involving human subjects is required to gain IRB 
approval through the formal review process described above. Certain types of 
research projects may qualify for expedited review. Expedited review may be carried 
out by the IRB chairperson or by one or more experienced reviewers designated by 
the chairperson from among members of the IRB. In reviewing the research, the 
reviewers may exercise all of the authorities of the IRB except that the reviewers may 
not disapprove the research. A research activity may be disapproved only after 
review in accordance with the non-expedited procedure. The Common Rule allows 
an IRB to use an expedited review procedure for one or both of the following: (1) 
research that the HHS Secretary has determined to be eligible for expedited review 4 
and found by the reviewer(s) to involve no more than minimal risk; (2) minor 
changes in previously approved research during the period (of one year or less) for 
which approval is authorized. 



4 A list of the HHS Secretary’s categories of research that qualify for expedited review is 
available at [http://www.hhs.gov/ohrp/humansubjects/guidance/expedited98.htm], visited 
Apr. 14, 2005. 
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The Common Rule defines minimal risk as that in which the probability and 
magnitude of harm or discomfort anticipated in the research are not greater in and of 
themselves than those ordinarily encountered in daily life or during the performance 
of routine physical or psychological examinations or tests (45 CFR 46.102(i)). 

Assurance of Compliance. The Common Rule’s primary mechanism for 
ensuring that a research institution is complying with regulatory requirements for 
IRBs and for other human research subject protections is through requiring 
institutional assurances. An assurance is a written document containing promises 
of regulatory compliance. To receive federal funding for research covered by the 
Common Rule, each institution is required to provide an assurance of compliance 
with the Common Rule to the head of the federal Department or Agency from which 
it is receiving funding. As an alternative, the institution may substitute an assurance 
provided to Office for Protection from Research Risks (OPRR, now the Office for 
Human Research Protections: OHRP), if the assurance is current, approved for 
federal-wide use by HHS, and applicable to the research in question. (45 CFR 
46.103(a)) 

To satisfy the Common Rule’s requirements, an assurance must certify that the 
research has been reviewed, approved, and will be subject to continuing review by 
an IRB (45 CFR 46.103(b)). The assurance must include, among other things: 

• designation of one or more IRBs established in accordance with the 
requirements of the Rule, and for which provisions are made for 
meeting space and sufficient staff to support the IRB’s review and 
recordkeeping duties(45 CFR 46.103(b)(2)). 

• written IRB procedures for initial, continuing, and expedited review, 
and for ensuring prompt reporting of certain unanticipated problems 
(45 CFR 46.103(b)(4)-(5)). 

• a statement of principles governing the institution for protecting the 
rights and welfare of human subjects of research conducted at or 
sponsored by the institution, regardless of whether the research is 
subject to federal regulation (45 CFR 46.103(b)(1). 

• a list of IRB members identified by name; earned degrees; 
representative capacity; indications of experience such as board 
certifications, licenses, etc., sufficient to describe each member’s 
chief anticipated contributions to IRB deliberations; and any 
employment or other relationship between each member and the 
institution; for example: full-time employee, part-time employee, 
member of governing panel or board, stockholder, paid or unpaid 
consultant (45 CFR 46.103(b)(2)). 

Through the assurance process, OHRP — which can approve assurances for 
federal-wide use — may gather the above information about some IRBs. 

The Common Rule and 45 CFR 46. The Department of Health and Human 
Services (HHS) (formerly the Department of Health Education and Welfare — 
DHEW - until 1980) was the first federal agency to publically develop formal 
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policies for the protection of human subjects. 5 In 1974, after more than 20 years of 
DHEW involvement and consideration, the regulations were codified: 45 CFR 46, 
Subpart A. In 1991, the terms of Subpart A of 45 CFR 46 were adopted by 16 federal 
agencies, thus creating the Common Rule. 

Since 1974, HHS has promulgated and amended additional regulations to give 
extra protections to certain groups of human subjects, including children, prisoners, 
and pregnant women, as well as fetuses and human in vitro fertilization. These 
regulations for the protection of vulnerable populations. 45 CFR 46 Subparts B, C, 
and D provide protections for women and neonates, prisoners, and children, 
respectively. These Subparts apply to HHS funded research, but are not a part of the 
Common Rule. They do not generally apply to the other federal agencies that have 
adopted the Common Rule, except for cases in which an agency has voluntarily 
adopted one or more of the additional Subparts. In this report, 45 CFR 46 will refer 
to the full regulation, including all Subparts. The Common Rule will refer only to 
the terms of Subpart A. 

Today the Common Rule governs 19 federal departments and agencies. 6 The 
Common Rule applies to research conducted at or funded by the agencies that have 
adopted it, though it has not been adopted by all agencies that fund research. 7 This 
means that, in order to be eligible to receive funding from one of the agencies that 
has adopted the Common Rule and/or other subsections of 45 CFR 46, researchers 
and institutions must abide by the relevant regulatory provisions. 8 It also means that 



5 In 1953, Secretary of Defense Charles Wilson issued a top secret memorandum 
establishing policy for research related to atomic, biological, and chemical warfare. The 
policy incorporated the principles of the Nuremberg Code and two additional protections 
— a prohibition on research involving prisoners of war and a requirement that the Secretary 
of the appropriate military service approve research studies. National Bioethics Advisory 
Commission, Ethical and Policy Issues in Research Involving Human Participants, Aug. 
2001, p.151. 

6 The Common Rule was developed as such by the Interagency Federal Coordinating 
Council for Science, Engineering and Technology. The following departments and agencies 
have adopted it: Department of Health and Human Services, Department of Agriculture, 
Department of Energy, National Aeronautics and Space Administration, Department of 
Defense, Consumer Product Safety Commission, International Development Cooperation 
Agency (Agency for International Development), Department of Housing and Urban 
Development, Department of Justice, Department of Defense, Department of Education, 
Department of Veterans Affairs, Environmental Protection Agency, National Science 
Foundation, and Department of Transportation. The Rule applies to the Central Intelligence 
Agency (by Executive Order 12333), the Social Security Administration (by P.L. 103-296), 
and the Department of Homeland Security (by P.L 108-458). The Office of Science and 
Technology Policy signed but did not codify the Rule because it does not conduct clinical 
research. 

7 For example, the Department of Labor and the Nuclear Regulatory Commission are 
reported to sponsor human subjects research but have not adopted the Common Rule. 

8 The Common Rule exempts some categories of research from its requirements, and gives 
Department or Agency heads final judgment as to whether a particular activity is covered. 
Examples of types of research that may qualify as exempt are those that involve the use of 

(continued...) 




